“NFC? That’s not secure.” It’s probably the most common objection we hear — and it comes from somewhere real: headlines about contactless payment fraud. The prejudice deserves a serious answer, not a salesman’s shrug. So we went to the studies. The short conclusion: the documented NFC attacks target payments and access cards — things with money or doors on the other side. An NFC business card has neither. The risk that remains is a different one, it is small, and it is mitigated by design. Let’s go step by step.
What researchers actually attack
NFC security research concentrates on two targets, and it’s worth seeing why.
Relay attacks on payments. The ReCoil study (arXiv, 2020) showed that, with carefully built passive coils, the read range of a payment card can be extended from the nominal ~5 cm to about 49 cm — enough to “brush against” someone’s pocket in a queue. The target is the bank card’s authentication protocol, because there is money on the other side.
Malware that relays through the phone. In 2024, ESET documented NGate, Android malware that relays the victim’s bank card NFC traffic to the attacker’s phone next to an ATM. Note what the attack requires: the victim has to be phished into installing a malicious app, entering bank credentials and tapping their own payment card against the infected phone. It’s sophisticated social engineering against payments — not a weakness of the chip.
As for the classic man-in-the-middle, the NFC-SEC whitepaper by Ecma International — the standards body — rates the practical risk as low in typical use cases, precisely because of NFC’s very short operating distance and radio characteristics.
Why none of this applies to your business card
An NFC business card is a passive tag: no battery, no processor running code, no secrets inside. It stores exactly one thing — a public link. The same link that’s in your email signature, on your LinkedIn and on the back of any paper card with a QR code.
No relay attack is possible because there is no transaction to relay. There is no “cloning” worth anything because the content is public by definition — cloning your business card gets you… your business card, which is its purpose. And reading the tag requires physical proximity of centimetres: nobody “sniffs” your card from across the room. We explained the physics of the tap here.
The risk that DOES exist — and how design kills it
Let’s be honest: there is one real vector, documented in a Kaspersky advisory on malicious tags — aimed mostly at tags in public spaces (posters, café tables): an unlocked tag can be rewritten to point at a phishing site, or physically swapped for another. It’s the NFC equivalent of sticking a fake QR sticker over a real one.
The mitigations are well known — Kaspersky recommends them and we build with them:
- Locked (read-only) tags. Our chips are written and then locked: third-party rewriting is physically disabled. It’s the number-one recommendation for organizations, and it’s our factory default, not an extra.
- Own domain, always visible. The tap opens the browser with the URL in plain sight — the same check you give any link. A tapcontact page lives on a recognizable HTTPS domain, not behind an anonymous shortener.
- The page executes nothing. Our contact pages are static HTML with zero JavaScript — no code runs on the phone of whoever taps, so there is no surface for “payloads”. The vCard downloads through iOS’s and Android’s native mechanism, no app.
- No permission requests. Tapping a card never asks for an install, contact access or credentials. If a tag ever asks you for those, that is exactly the alarm signal Kaspersky describes — on another platform.
The comparison nobody makes: what about paper?
The paper card has always been “forgeable” too — any print shop will print a card with your name and a wrong number. We never treated that as a security crisis because the social context of the handshake validates the exchange. The NFC card inherits that validation and adds something paper doesn’t have: a verifiable destination, on an HTTPS domain, controlled by your organization — which can revoke or forward it when it should no longer speak for it.
A security checklist for anyone buying NFC cards
Take these questions to any vendor, including us: do the tags ship locked from the factory? Does the URL open on an own domain with HTTPS, visible to whoever taps? Does the page run JavaScript or ask for permissions? What data about the people who tap is stored — and where? The right answers are: yes, yes, no, and almost none, in the EU.
Still have a concrete security question? Write to us — a person who knows what an NDEF tag is will answer, not a chatbot.